Prompt injection examples fall into two groups: direct attacks, where a user types instructions meant to override a model’s rules, and indirect attacks, where hidden instructions sit inside a web page, email or document that a model reads on someone else’s behalf. Both work because a language model treats everything in its context as text it may follow, with no reliable wall between trusted instructions and untrusted data.
Key Takeaways
- Direct attacks come from the person typing; indirect attacks hide inside content that an AI model reads.
- OWASP ranks prompt injection as LLM01, the top risk for large language model applications.
- Documented cases include a zero-click email attack on Microsoft 365 Copilot (EchoLeak, CVE-2025-32711) and a hijacked pull request that reached users of Amazon’s AI coding extension.
- The UK National Cyber Security Centre (NCSC) warns that prompt injection may never be fully mitigated, so the goal is limiting the damage.
- Least privilege, human approval for risky actions and monitoring of tool calls reduce impact more than any single filter.
AI assistants now read inboxes, browse the web and call tools, which turns every piece of outside text into a possible instruction. The site’s guide to what prompt injection is covers the basics. This article walks through the patterns attackers use, the documented incidents behind them and the defenses that hold up best.
Table of Contents
The Short Answer
Prompt injection works because large language models read instructions and data in one stream of tokens. OWASP describes it as input that alters a model’s behavior in unintended ways. The NCSC argues that the missing line between “data” and “instruction” makes the problem harder to fix than classic SQL injection.
Seven Prompt Injection Examples That Show the Pattern
The cases below range from textbook scenarios to incidents tied to real products. Each one follows the same logic: text that should have been treated as content was treated as a command.
1. The “ignore previous instructions” override
OWASP’s first attack scenario is direct. An attacker tells a customer-support chatbot to ignore its guidelines, query private data stores and send emails, which leads to unauthorized access and privilege escalation. The phrase is the best-known opener, yet blocking it helps little. Digit’s summary of the NCSC advice notes that filtering common injection phrases has limited reach because prompts can be worded in endless ways.
2. Hidden instructions on a web page
OWASP’s second scenario is indirect. A person asks a model to summarize a web page, and the page contains hidden instructions. The model follows them by inserting an image that links to an attacker-controlled URL, which leaks the private conversation. The person typed nothing malicious; the page did the work.
3. A crafted email with no clicks (EchoLeak)
Cycode’s review of the OWASP agentic list describes EchoLeak, tracked as CVE-2025-32711, as proof of zero-click data exfiltration: a single crafted email pulled corporate data out of Microsoft 365 Copilot without the recipient clicking anything. An assistant with access to mail and files turned one inbound message into a data leak.
4. Planted posts aimed at agentic browsers
Malwarebytes reported that researchers found embedded instructions in Reddit posts could potentially steer agentic browsers into draining a user’s bank account. Browsing agents read pages the way a person does, but they also act, which is why the site’s explainer on the agentic browser treats page content as an attack surface.
5. Hidden text in documents
OWASP’s reference list includes a write-up on injecting text into a resume PDF. The idea is that a file can carry wording invisible to a human reader yet fully visible to a model that screens or summarizes it. Any workflow that feeds uploaded documents to a model inherits this risk.
6. A poisoned pull request in a coding assistant
Cycode also points to the Amazon Q incident: a hijacked pull request shipped data-wiping instructions to nearly a million developers through Amazon’s AI coding extension, which had more than 950,000 installs. A coding assistant that trusts its own supply chain can be turned against its users.
7. A compromised tool server
Agents that connect to external tools add another entry point. Cycode cites one test in which a single compromised MCP server reached a 78.3 percent attack success rate in a five-server agent setup. That figure comes from one secondary summary and one test configuration, so it signals the risk rather than a general rate. The Model Context Protocol explainer covers how these tool connections work.
The Seven Cases at a Glance
| Case | Type | Where the instruction hides | Potential impact |
|---|---|---|---|
| Override phrase | Direct | User’s chat message | Data access, emails sent, privilege escalation |
| Hidden page text | Indirect | Web page being summarized | Private conversation leaked through a URL |
| EchoLeak | Indirect | Inbound email | Zero-click corporate data exfiltration |
| Planted posts | Indirect | Social posts read by a browser agent | Unauthorized account actions |
| Document text | Indirect | Uploaded resume or PDF | Manipulated screening or summaries |
| Amazon Q incident | Supply chain | Pull request in an extension | Data-wiping instructions delivered to developers |
| Compromised server | Indirect | Tool server output | Agent actions redirected |
Why These Attacks Work
A language model predicts the next token from everything in its context. Developer rules, a user’s question and a retrieved web page all arrive as the same kind of text. The NCSC wrote in December 2025 that, because there is no inherent distinction between data and instruction, these attacks “may never be totally mitigated” the way SQL injection largely has been. The agency urges builders to treat models as “inherently confusable deputies” and to design systems that limit what a compromised output can do.
A stronger system prompt does not close the gap. OWASP’s glossary says prompt hardening raises the cost of a successful injection but does not make it impossible. Agents raise the stakes because AI agents act with delegated permissions, while a chatbot that gives a bad answer mostly wastes time.
How to Reduce the Damage
- Mark outside content as data. The NCSC recommends separating data sections from instructions wherever possible.
- Grant least privilege. Limit what each agent can read, send, spend or delete, and keep irreplaceable assets out of reach.
- Require human approval for high-risk actions such as payments, deletions and outbound messages.
- Filter inputs and outputs as one layer among several, never as the only control.
- Monitor tool calls. The NCSC notes that failed tool or API calls can signal an attacker probing a system.
- Be cautious with vendors that claim to stop injection outright. The NCSC suggests favoring those that explain how they reduce risk.
Key Terms at a Glance
- Direct prompt injection: malicious instructions typed by the person using the model.
- Indirect prompt injection: instructions hidden in external content the model reads, such as pages, emails or files.
- Confused deputy: a privileged component coerced into acting for a less-privileged attacker.
- Zero-click attack: an attack that succeeds without the victim opening or approving anything.
- Data exfiltration: the unauthorized transfer of data out of a system.
Conclusion
The documented cases show one lesson repeated in different settings: anything a model reads can become an instruction. Defenders cannot count on a perfect filter, so the practical path is smaller permissions, human checkpoints and close monitoring. Readers building with agents can continue with the agent versus chatbot comparison to see why autonomy changes the risk.
Frequently Asked Questions
What is the difference between direct and indirect prompt injection?
Direct injection comes from the person typing to the model, while indirect injection hides in content the model retrieves, such as a web page, email or document. Indirect attacks are usually more dangerous because the victim never sees the malicious text.
Is prompt injection the same as jailbreaking?
The two are related but not identical. Jailbreaking aims to get past a model’s safety rules, and OWASP notes the terms are often used interchangeably. Prompt injection is broader and includes hidden instructions inside outside content that redirect what a model does.
Can prompt injection be fully prevented?
No complete fix exists today. OWASP notes there is no foolproof prevention method, and the NCSC warns it may never be totally mitigated, so layered defenses and limited permissions are the recommended approach.
Why are AI agents more exposed than chatbots?
Agents read external content and take actions with real permissions. A hijacked chatbot produces a bad answer, while a hijacked agent can send data, change settings or move money.
Does a better system prompt stop these attacks?
A better system prompt helps but does not solve the problem. OWASP says prompt hardening makes overriding harder without making it impossible.
What was EchoLeak?
EchoLeak, tracked as CVE-2025-32711, was a zero-click flaw in which a crafted email led Microsoft 365 Copilot to expose corporate data, according to Cycode’s review of the OWASP agentic list.
Sources
- OWASP GenAI Security Project: LLM01 Prompt Injection
- OWASP GenAI glossary: Prompt Injection
- UK NCSC: Prompt injection is not SQL injection
- Computer Weekly: NCSC warns of confusion over the nature of prompt injection
- Cycode: OWASP Top 10 for Agentic Applications
- Malwarebytes: Prompt injection is a problem that may never be fixed
The Future AI Wire Editorial Team covers artificial intelligence, AI agents, agentic AI, and emerging technologies. We publish clear, research-informed explanations and practical insights to help readers understand AI developments, real-world applications, and the technologies shaping the future.